fixes: wso2/api-manager#2101

wso2 · Aug 18, 2023 · d340b62 · d340b62
1 parent ec4d243
commit d340b62
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/...rg/wso2/carbon/apimgt/gateway/handlers/security/authenticator/MutualSSLAuthenticator.java b/...rg/wso2/carbon/apimgt/gateway/handlers/security/authenticator/MutualSSLAuthenticator.java
@@ -75,7 +75,11 @@ public MutualSSLAuthenticator(String apiLevelPolicy, boolean isMandatory, String
             for (String certificatePart : certificateParts) {
                 int tierDivisionIndex = certificatePart.lastIndexOf("=");
                 if (tierDivisionIndex > 0) {
-                    String uniqueIdentifier = certificatePart.substring(0, tierDivisionIndex).trim();
+                    String uniqueIdentifier = certificatePart.substring(0, tierDivisionIndex)
+                            .replaceAll("&amp;", "&")
+                            .replaceAll("&lt;", "<")
+                            .replaceAll("&gt;", ">")
+                            .trim();
                     String tier = certificatePart.substring(tierDivisionIndex + 1);
                     certificates.put(uniqueIdentifier, tier);
                 }

diff --git a/...rbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/utils/CertificateMgtUtils.java b/...rbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/utils/CertificateMgtUtils.java
@@ -617,7 +617,9 @@ public String getUniqueIdentifierOfCertificate(String certificate) {
                 Certificate generatedCertificate = cf.generateCertificate(serverCert);
                 X509Certificate x509Certificate = (X509Certificate) generatedCertificate;
                 uniqueIdentifier = x509Certificate.getSerialNumber() + "_" + x509Certificate.getIssuerDN();
-                uniqueIdentifier = uniqueIdentifier.replaceAll(",", "#").replaceAll("\"", "'");
+                uniqueIdentifier = uniqueIdentifier.replaceAll(",", "#").replaceAll("\"", "'")
+                        .replaceAll("&", "&amp;")
+                        .replaceAll("<", "&lt;").replaceAll(">", "&gt;");
             }
         } catch (CertificateException e) {
             log.error("Error while getting serial number of the certificate.", e);